PatchSiren cyber security CVE debrief

CVE-2022-43939 Hitachi Vantara CVE debrief

CVE-2022-43939 is a Hitachi Vantara Pentaho Business Analytics (BA) Server authorization bypass issue tied to non-canonical URL paths being used for authorization decisions. CISA lists it in the Known Exploited Vulnerabilities catalog, so defenders should treat it as an actively relevant exposure and prioritize remediation on any affected Pentaho BA Server instance.

Vendor: Hitachi Vantara
Product: Pentaho Business Analytics (BA) Server
CVSS: HIGH 8.6
CISA KEV: Listed
Original CVE published: 2025-03-03
Original CVE updated: 2025-03-03
Advisory published: 2025-03-03
Advisory updated: 2025-03-03

Who should care

Security teams, system owners, and administrators responsible for Hitachi Vantara Pentaho Business Analytics (BA) Server deployments—especially environments exposed to the internet or used for sensitive reporting and analytics.

Technical summary

The vendor’s resolved advisory identifies the issue as use of non-canonical URL paths for authorization decisions in Pentaho BA Server. The advisory notes affected versions before 9.4.0.1 and 9.3.0.2, including 8.3.x. CISA’s KEV entry classifies the vulnerability as known exploited and sets a due date for remediation. No CVSS score was provided in the supplied corpus.

Defensive priority

High. This vulnerability is in CISA’s KEV catalog, indicating it should be remediated promptly and verified across all Pentaho BA Server installations.

Recommended defensive actions

Confirm whether any Pentaho Business Analytics (BA) Server deployments are running versions before 9.4.0.1 or 9.3.0.2, including 8.3.x.
Apply the vendor’s mitigations or upgrade to a fixed version as directed in the official Pentaho advisory.
Follow CISA BOD 22-01 guidance for cloud services where applicable.
If mitigations are unavailable, discontinue use of the affected product until a supported fix can be applied.
Prioritize remediation for internet-facing systems and verify that all instances, including test and backup environments, are covered.

Evidence notes

CISA’s KEV record lists Hitachi Vantara Pentaho Business Analytics (BA) Server as a known exploited vulnerability and includes the vendor advisory reference: “Resolved Pentaho BA Server Use of Non-Canonical URL Paths for Authorization Decisions Versions before 9.4.0.1 and 9.3.0.2 including 8.3.x Impacted CVE-2022-43939.” The supplied corpus also states required actions: apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use if mitigations are unavailable. Known ransomware campaign use is listed as Unknown.

Sources and references

Verified primary and authoritative sources

CVE-2022-43939 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2022-43939

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2022-43939 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2022-43939

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.
CISA Known Exploited Vulnerabilities catalog
Publisher, destination, and source semantics verified

URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Cybersecurity and Infrastructure Security Agency - Official CISA catalog of vulnerabilities known to be exploited in the wild.

Supplemental references

Source item URL
Unverified legacy reference

URL: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json

cisa_kev

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.